Requires the architecture to manage consent, access restrictions, withdrawal, opt-out choices, delegated authority and legally defined exceptions in a consistent and auditable manner across primary and secondary use.